CVE-2026-43334

Vulnerability

In the Linux kernel's Bluetooth subsystem, the SMP (Security Manager Protocol) pairing handshake has a logic flaw in smp_cmd_pairing_req(). The responder builds the pairing response using the initiator's auth_req before enforcing its own local BT_SECURITY_HIGH requirement. If the initiator does not include the SMP_AUTH_MITM flag, the responder's response may also omit it, even though the local side still requires MITM protection [1].

Exploitation

An attacker within Bluetooth range (unauthenticated, pairing phase) can exploit this by initiating a pairing request without the MITM flag. The vulnerable responder may then generate a response lacking MITM, leading to an inconsistent security policy. No authentication is needed initially, as the flaw occurs during the pairing setup before any keys are exchanged [1].

Impact

This inconsistency allows the attacker to downgrade the security method, potentially bypassing MITM protection during pairing. The method selection in tk_request() may choose JUST_CFM (just works) instead of requiring user confirmation, enabling a passive eavesdropper to complete pairing without detection. The result is weaker bonding than intended, exposing subsequent encrypted connections to MITM attacks [1].

Mitigation

The vulnerability is fixed in the Linux kernel stable repository by commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7. The fix ensures that when the local side requires HIGH security, MITM capability is verified from IO capabilities and the SMP_AUTH_MITM flag is forced into the response before building it. Users are advised to update their kernels to include this patch [1].